Virtualization Technology News and Information
Checkmarx 2021 Predictions: Secure Software Development Takes Center Stage

vmblog 2021 prediction series 

Industry executives and experts share their predictions for 2021.  Read them in this 13th annual series exclusive.

Secure Software Development Takes Center Stage

By Maty Siman, CTO, Checkmarx

2020 has taught us a lot, but one thing in particular that's stood out is that technology and the underlying software powering it is more essential than ever for maintaining continuity within our business settings and personal lives. Not only has software allowed us to maintain a sense of normalcy during this anything-but-normal year, but it's also enabled organizations to push the boundaries of innovation and creativity and position themselves for the long-haul of this digital transformation movement that's been building for years.

Today, every thriving company is ultimately a software company in some way, shape, or form, making software security a top priority for business leaders, security teams, and developers alike. As we look ahead to 2021, here are my top predictions to watch for in the software security space -- from open source to infrastructure as code, and everything in between.

1.  Security will race to catch development speeds and adapt to the cloud.

Developing and releasing applications fast while maintaining security is a mindset that while talked about, is not being executed effectively. Cloud development needs to happen fast with as many drops as possible. And with that, the current philosophy from many organizations is to get software quickly into production and roll back if a bug is found, so they can push as many features as quickly as possible. But this doesn't work with security. You can't push code and then roll back to fix vulnerabilities, as it presents an opportunity for malicious actors to infiltrate your system. In 2021, the tools used for application security that integrate into the tool chain must work much more rapidly, scale to cloud environments, and present actionable findings in a format that developers can understand and use to make quick fixes.

2.  Open source hacking will accelerate while organizations look to thwart malicious actors.

Hackers find open source to be an easy way into organizations, and this trend will only accelerate in 2021. Rarely does a week go by without a discovery of malicious open source packages. Yes, organizations understand they need to secure the open source components they're using and existing solutions help them in removing packages that are mistakenly vulnerable (where a developer mistakenly puts a vulnerability into the package) -- but, they are still blind to instances where adversaries maliciously push tainted code into the packages. In fact, a recent study found that nearly one in five bugs within open source software are planted for malicious purposes. This ‘blind eye' needs to change in 2021.

As a baseline, it's best to stick to well-known (vs. immature) open source components for critical projects and to review the policies by which open source projects accept new contributors.

3.  Demand for cloud-based security increases use of infrastructure as code (IaC).

The overnight digital shift that occurred in 2020 forced many organizations to turn to the cloud. The cloud offers obvious advantages in order to support a dispersed workforce. But with this transition comes new challenges, with one of the biggest revolving around the emergence of infrastructure as code (IaC).

IaC has forced many developers into uncharted waters, due to the lack of proper training and mounting pressure to build code quickly in these environments. The actual architecture of this code is extremely complex and the security tools on the market today are generally too disparate to detect the gaps in the code. In 2021, I expect to see malicious attackers exploit developers' missteps in these flexible environments. To combat this, we will see a major concentration around cloud security training, IaC best practices and additional spend allocated toward software and application security to support the demand of a remote workforce and more complex software ecosystems.  

4.  Security will report to development, not the other way around.

It's no secret that developers are trendsetters in organizations that are driving toward digital transformation. Integrating security into software development needs to take both a bottom up and top down approach. Developers are opinionated and increasingly influential, and you cannot force them to do or use something they don't buy into. To foster collaboration between security and development, security in 2021 will need to integrate into the development tool chain in a manner that the latter is most comfortable with. Developers are no longer willing to switch between different interfaces (one for development and one for security) -- nor should they have to if speed is demanded equally with security. They want to consume all data, whether we're talking about data pertaining to quality issues or security issues, in a streamlined manner. Security will meet developers where they are, using the interfaces and tools they prefer. 

5.  Context will be king. With holistic views of the application, security posture improves. 

Next year, we'll see a departure from "one trick pony" solutions. 2021 will bring AppSec market convergence as the demand from organizations to get a holistic perspective on the security posture of their applications from several vantage points (e.g., understanding application context and meshing it with infrastructure as code) drives adoption of one-stop-shop solutions that provide a full ecosystem view. When it comes to the security of open source in particular, more comprehensive views will allow organizations not only to know if they are consuming a vulnerable package, but also, whether or not the way that the application consumes it makes an attack or vulnerability possible.

This is one specific example. When a vulnerability exists in an open source component, in order for a hacker to exploit that vulnerability, three conditions need to be met: 1) you need to consume that open source in that vulnerable version, 2) your application needs to code to a specific function in that open source, and 3) your infrastructure as code needs to open a specific port. Only by having contextualized insight by combining these three pieces of data will you accurately be able to tell if you are vulnerable to attack. 


About the Author

Maty Siman, Founder and CTO at Checkmarx

Maty Siman 

Maty has been active in the IT industry for the past 12 years and has experience in software development, IT security and source-code analysis. Prior to founding Checkmarx, Maty worked for two years at the Israeli Prime Minister's Office as a senior IT security expert and project manager.

Published Thursday, January 21, 2021 7:41 AM by David Marshall
There are no comments for this post.
To post a comment, you must be a registered user. Registration is free and easy! Sign up now!
<January 2021>